Three years ago, PyPI began an initiative to build a more secure, lasting foundation for both publishing and signing Python packages. This initiative yielded two techniques, both built on public key cryptography: Trusted Publishing, which uses OpenID Connect to establish misuse-resistant credentials between PyPI and CI/CD systems, and Attestations, which uses machine identities and Sigstore to provide zero-setup package signing by default.

This talk offers a three year retrospective on that initiative: where it’s gone well, where it’s gone poorly, what other ecosystems have gleaned from Python/PyPI’s experience, and what the future holds for signature and transparency techniques in Open Source packaging.

NOTE: At some points this video blanks briefly to a white screen to obscure attendees with red lanyards who did not consent to being recorded.

plus-circle Add Review

comment

Reviews